This vulnerability arises from an out‑of‑bounds write in LibRaw’s JPEG DHT parser, specifically within the HuffTable::initval function. By manipulating the bits array, an attacker can corrupt memory when LibRaw processes a JPEG file, potentially enabling arbitrary code execution. The weakness is classified as a buffer overflow and improper size calculation, which could compromise confidentiality or integrity.

The flaw affects the LibRaw image processing library up to version 0.22.0, including all builds that ship with the vulnerable losslessjpeg.cpp parser. The vendor provides a fix in version 0.22.1. Any application that incorporates this legacy library and processes JPEG images from untrusted sources is potentially impacted.

The CVSS score of 5.3 reflects a moderate risk level, and the vulnerability can be triggered remotely via crafted input. No publicly listed exploitation statistics are available, but the existence of a publicly exposed proof‑of‑concept indicates the attack is plausible. The vulnerability is not currently listed in CISA’s KEV catalog, meaning it has not yet been seen widely exploited in the wild, yet the available exploit code suggests a realistic threat.